Software

Ask a team what they shipped this year and you will get a list. Ask what they killed and the room goes quiet. Liam Nugent has twice refused to build the two features everyone asks for in consumer finance apps — a document hub and a notifications centre — and his essay is the case for those refusals. Both features follow the same shape: A real problem underneath: legacy systems emit PDFs, and compliance wants a “persistent communications channel” A lazy solution that looks simple: a list of files, or a bell icon with a red dot Stakeholders adding “just one more thing” until you have rebuilt Google Drive or a bad Gmail clone A permissions model, per-platform quirks across every iOS release cycle, and a maintenance bill that never ends The build cost turns out to be the small number. What actually changes stakeholders’ minds is seeing the running cost laid out over years — that “tends to bring people back from the brink.” And killing the platform does not remove the original problem, so he takes each use case on its own merits and asks whether it needs an entire platform before it can be said at all. Most of the time the answer is something simple or something that already exists, “even if it isn’t perfect.” ...

Bryan Cantrill reduces Sun Microsystems’ failure to one sentence: the company had become bored with the mechanics of running a business. His evidence is a 2005 episode that was, on paper, a vindication of Sun open-sourcing Solaris. A startup growing like a weed — one of the companies pioneering what we would later call cloud computing — was running its infrastructure on OpenSolaris and wanted to buy a large amount of Sun hardware. The strategy had worked. The customer was standing there with money. ...

In May 2003, the University of Wisconsin-Madison’s public time server started taking hundreds of thousands of packets per second — enough to break campus routers. The obvious response was the one for a DDoS: block it upstream and wait for it to subside. A month later it was still running, and bigger. The traffic was not malicious. It was roughly 700,000 Netgear residential routers, each of which had ntp1.cs.wisc.edu’s IP address compiled into its firmware, each polling that one host once per second until it got a reply. ...

Will Keleher spent the first few years of his career unable to tell his computer to do anything: no sequencing, no conditionals, no loops, no pipelines. He ran commands one at a time and treated the terminal as the world’s worst GUI. This essay is what changed, and it is not really about syntax. The list of things he couldn’t do is a good checklist for the gap: Do one thing, then do another Log an error when a command fails Start a program at boot Run two commands at the same time Loop over every file in a directory Feed one command’s output into the next His first working script — set +e, capture $?, set -e — was wrong, and it was still transformational. The footnote fixes it in one line: if’s main mode is taking commands, so [[ is just a command and the check collapses to if ! npm install; then. ...

Go 1.27 makes allocations of 80 bytes or fewer 20–30% faster, which works out to roughly 1% on allocation-heavy programs. Michael Matloob’s write-up on the Go blog explains the mechanism: instead of one general allocator entry point, the runtime now generates a specialized function per span class. The mechanics: Small allocations are bucketed into size classes — 1–8, 9–16, 17–24, 25–32, 33–48, 49–64, 65–80 bytes — each with its own free list of objects sized to the class maximum. A span class encodes both facts the allocator needs: sizeClass<<1 | noPointers, since the GC needs to know whether the block holds pointers. The runtime emits one specialized variant per span class. mallocgcSmallNoScanSC3 is small, pointer-free, size class 3. Where the compiler knows the span class at compile time, it inserts a direct call to the specialized function instead of calling newobject. Anything unusual — GC active, or a dynamically sized allocation the compiler can’t resolve — falls back to generic mallocgc, which still has to dispatch to the specialized function dynamically. So the specialized versions have to be fast enough to win even with that overhead. Why stop at 80 bytes? Two forces. Specialization buys less as sizes grow, because the allocation starts being dominated by clearing memory. And every added function inflates binaries and competes for instruction cache — mallocgc is in the icache constantly, and crowding out user code cancels the gain. They benchmarked across size classes and picked 80 bytes as the sweet spot. ...

Every item on the menu at Taco Bell is a different configuration of roughly eight ingredients — and that periodic table of meat and produce pulled down $1.9 billion. Ted Dziuba’s 2010 essay asks why systems aren’t designed the same way: clever reconfiguration of the basic Unix tool set instead of new infrastructure. His thesis fits in a line: functionality is an asset, but code is a liability. The examples are the argument: ...

Here is a fact that surprises almost everyone who hears it: in C++, while (true); — an empty loop with a constant-true condition — was undefined behaviour. Not since some ancient standard, but from C++11 onward. Sandor Dargo walks through the standardese, the compiler behaviour it licensed, and the C++26 fix. The practical consequence is not theoretical. Clang would remove the loop and let execution fall through into whatever the linker placed next, which is how the canonical Godbolt example ends up printing “Hello world!” from a function that was never called. That is not a compiler bug. It is a correct optimisation applied to code the standard said had no defined meaning. ...

Laurie Voss spent five years at npm and has been trying to write this post since 2013. It finally exists, at about five thousand words, and its argument is that every open-source funding conversation for the last thirty years has been asking the wrong party for money. Start with why nothing has worked. Voss borrows the hawks-and-doves model from evolutionary biology: the stable license is “anybody may use this for anything, including commercially, for free,” and every project that tried to be a slightly less generous dove lost to the full dove next door. ...

Buchodi, who writes about what mobile apps actually do with your data, rebuilt OpenAI’s ad-tracking machinery on his own phone, verified it with two independent capture methods, and cross-checked the result against months of observed traffic. The finding is narrow and concrete: when a business buys ads on ChatGPT, the tracking code OpenAI gave it can tie the visitor’s browsing on that business’s own website back to the visitor’s ChatGPT account. ...

Vinícius dos Santos Oliveira builds sandbox support into Emilua, his LuaJIT execution engine, and wrote up the route through a field he describes as mostly uncharted: the pieces you need are scattered across kernel APIs, libc interposition tricks and papers, with no unified map. He starts from Julien Tinnes and Chris Evans’ definition, and it does the load-bearing work for everything after it. Sandboxing means discretionary privilege dropping — restricting a process’s privileges programmatically, without administrative authority on the machine. That rules out a lot of things people call sandboxes, including sysadmin filesystem permissions, which a program must never be able to rewrite. ...

Bartosz Fenski maintains an automatically re-run benchmark suite for multi-device copy-on-write filesystems: 26 configurations across ext4, XFS, ZFS, btrfs and bcachefs, from single devices to md/LVM RAID10, ZFS mirrors and RAIDZ, btrfs RAID6 with RAID1C3 metadata, and bcachefs replicas and erasure coding — several with LUKS or dm-integrity on top. It runs on GitHub-hosted VMs over four 16 GiB loop devices, one fresh VM per configuration, with a host-calibration anchor per run and the standing instruction to compare shapes and ratios rather than absolute throughput. ...

Sunil Pai writes to a friend who just took a very senior, very well-paid job at a new company and asked how to work 60-to-80-hour weeks to earn a promotion. His answer: that instinct is the setup for what he calls the senior engineer death spiral. He has run it himself, more than once, which is how he now catches it early. The pattern, in order: You decide you need to cosplay a level above where you are, and design something more ambitious than the work requires. You go quiet. Two or three weeks with nothing to show. Standup gets the “positive update”: things are going well, I’ll have something soon, reach out if you have questions. Nobody reaches out. Privately the arithmetic turns punitive — “I haven’t shipped, so I’ll do a month’s work in one week and no one will know.” Sleep, meals and both work and personal relationships go first. The exits are a month off, a PIP, a firing, or quitting because it looks unsalvageable. Why it bites harder now: remote work, COVID-era habits and coding agents stripped out the old structure of sitting next to someone who hands you a queue of tickets. Engineers get more ownership and less visibility at the same time, so silence is easier to sustain and more expensive when it finally breaks. ...

Gianni Rosato works on image compression at Halide Compression, with a background in AV1 and AVIF tooling. He spent years as a JPEG XL advocate — he endorsed the format for Interop 2024 and speaks well of its authors — and this essay is a public reversal, argued from measurements rather than the browser-politics framing that usually carries the debate. The case against, in his numbers: AVIF now dominates the entire fidelity range, so JPEG XL’s one real advantage — better lossy quality at medium-high fidelity — has disappeared. Lossless was never the Web’s problem. JXL’s lossless gains are roughly 12% over lossless WebP, measured on a dataset that does not resemble Web image traffic. Decode time is the disqualifier. In size-matched encodes, WebP came in about 90KB larger and still decoded more than 10x faster than the Rust JPEG XL decoder. The format itself is disadvantaged, not merely its reference encoder: no directional prediction modes, no deblocking loop filter, and XYB colorspace savings that come partly from aggressively quantizing the blue channel. Non-photographic content is awkward — patches cost far more bitstream overhead than AV1’s Intra Block Copy, and can exceed the savings. Expressivity is a foot-gun. He demonstrates a 1,918-byte JXL that takes 17.4 seconds of user time to decode on an M5 Pro, which makes cheap denial-of-service against low-end devices possible now that the Rust decoder is shipping in Chrome and Firefox. JPEG recompression still saves bits, but costs about 33% more decode time, so it is not free. He separates the engineering from the politics carefully. His read is that most of the argument for JPEG XL in browsers comes from wanting a Web with more developer choice after the WebP and AVIF fights — a legitimate goal, but a different claim than technical superiority. Both formats are royalty-free, and JPEG XL came out of Cloudinary and Google as much as anywhere. ...

besok spent seven years as a Rust developer and made the comparison honest by reimplementing his own library in Zig: jsonpath-rust (RFC 9535 JSONPath) rebuilt as zig-jsonpath. Not a toy, not sprawling, and something the community can use. He states the caveat up front — first Zig project, so some decisions came from Rust habits rather than Zig idiom. What the port actually surfaced: IDE support was the memorable surprise: little beyond syntax highlighting and basic completion. That pushed him to the CLI, made build.zig the centre of the workflow (zig build test -Dfilter=..., -Ddebug-query=true, a compliance target), and ended with him moving off a full IDE entirely. Flat structure is the default. The Rust version needed 11 files across nested folders; the Zig version fit in four files. He does not think it scales, but the threshold for needing hierarchy is much higher than he expected — which made him question reaching for folders out of habit. No functional paradigm. Rust’s combinators, monadic error handling, and immutable transforms give way to in-place mutation, forks of cursor state, and explicit loops. He found the Zig code less readable, and treats that as an honest reflection of each language’s design goals. Allocators are everywhere and you enforce the rules by hand. Three failures bit him: a forgotten deinit, a deinit skipped on an error path, and a double deinit when ownership was handed off. Zig’s test allocators caught all three — but only after he wrote the tests that exercise the failing allocations. Ecosystem and API maturity are the real costs: scarce libraries, a regex engine without Unicode property escapes (which surfaced directly while implementing RFC 9535 filter functions), and a standard library whose API shifts between versions. The verdict is measured: straightforward, modern, fast, and a credible successor to C — still young, with rough edges he expects to smooth out as it matures. ...

Written by the maintainer of dial9 (a flight recorder for Tokio) after a RustConf Unconf session, this is a living document of async Rust performance principles. The honest framing up front: there are few hard-and-fast rules, because performance depends on what else is running on the runtime at that moment — which is why so many of these problems only show up in production. The principles that carry the most weight: ...

Factorio is a deterministic simulation, which raises an obvious question: how does it produce random quality rolls? It doesn’t. The game uses taus88, three linear-feedback shift registers XORed together — a generator the developers picked in 2014 because it was the fastest in Boost. A two-year reverse-engineering project starts from that forum post, confirms it against the decompiled binary, and ends with a working prediction rig built entirely out of combinators. ...

A ticket landed with the Cloudflare performance team: the Pingora Backend Router was using far more memory than expected — 6GB in the worst processes. The cause was consistent hashing, and the fix was equal parts statistics and struct layout. Together they reclaimed 100TB of RAM across the network. Why consistent-hash rings get so expensive: Every server gets 160 ring points (NGINX’s hardcoded default, inherited by Pingora), scaled by a weight — usually disk space. A heavily weighted server can carry ~100,000 points. Any server that can only serve certain request types needs its own ring, and every combination of features potentially needs another. A handful of features becomes dozens of rings, all resident in memory. Each ring point was 8 bytes: a 32-bit hash plus a 32-bit server index. The memory work came in two parts: ...

FEX-Emu runs x86 Linux binaries on ARM. Almost every hard performance problem it has traces back to one mismatch: x86’s Total Store Ordering memory model versus ARM’s relaxed one — with benchmarks to show what each shortcut costs. What makes x86 different: Under x86-TSO, stores become visible to other cores in program order, and unaligned loads and stores inside a cacheline are atomic — they never tear, even in a race. ARM’s weak model guarantees none of that by default. Unaligned accesses can tear, and acquire/release-style ordering costs real bandwidth when it is the common case rather than the exception. The baseline mapping (every x86 load becomes a load-acquire, every store a store-release, with memory barriers patched in for unaligned accesses) is correct but slow. On some CPUs the store path collapses entirely. What hardware has actually delivered: ...

In May 2026 the TanStack npm packages were backdoored with credential-stealing malware. Four months later, an archive of roughly 170 private CrowdSec GitHub repositories showed up on a breach forum — the first CrowdSec heard of it. Their CEO wrote up the whole investigation, including the parts that went nowhere. The mechanism is mundane, which is the point: A departing employee kept org access to finish up some work, and his laptop was running the compromised packages A live GitHub OAuth token was still embedded in the clone URL inside .github/.git/config Two hours of clones on 22 May 2026 from an IP in Toronto. No commits, no code changes, nothing touched in CI or infrastructure The token was already gone by the time anyone looked — it was created, used, and died without leaving a trace of its own The forensics nearly stalled there. GitHub’s org audit log only records specific actions, and non-Enterprise plans keep git activity for a rolling seven days. The account was deprovisioned three days after the clone, so the trail had gone cold. GitHub support eventually traced the token’s lifecycle by hand, and that is what confirmed TanStack as the vector. ...

Jens Egholm Pedersen works in neuromorphic computing and spends a lot of his time on software. Colleagues keep asking why — software is a time sink, something to rush past on the way to results and papers. His answer is that in computational science, the software is the result. The argument starts from Wikipedia’s definition of science: systematic, testable, organized knowledge. Then it asks whether a reader can actually test a typical arXiv paper. Usually not directly — you have no access to the knowledge inside. Drawing on Craik’s idea of inner models, he argues a paper is science only insofar as it lets the reader improve their own predictive model of the world. Code is how a computational model gets encoded and shared, so hiding it breaks the method rather than just annoying readers. ...